Also Known As:
Win-Trojan/Bancos.479720 (AhnLab)
Win32/Bancos.IVV (CA)
Trojan-Spy.Win32.Bancos.apq (Kaspersky)
Spy-Agent.cj.gen.h (McAfee)
W32/Banker.CDRQ (Norman)
Mal/Emogen-T (Sophos)
Trojan.Banker.Delf (Sunbelt Software)
Infostealer.Bancos (Symantec)
TSPY_BANKER.YY (Trend Micro)
Summary
TrojanSpy:Win32/Bancos.gen!A is a password stealing trojan, that targets specific online banking web sites. Captured credentials may be sent via SMTP e-mail to a specified e-mail address.
Symptoms
System Changes
The following system changes may indicate the presence of Trojan:Win32/Bancos.gen!A:

*
Presence of the file <system folder>\explori.exe
*
Presence of this registry value and data:
Adds value: "explorer"
With data: "<system folder>\explori.exe"
To subkey: HKEY_LOCAL_MACHINE\Software\Microsoft\Windows\CurrentVersion\Run

===============

但是，无论是查那个文件，还是查注册表，没有它描述的东西啊。怎么回事呢？